Forensic analysis of Twitch video streaming activities on Android

Alzahrani, Ali; Wani, Mohamad Ahtisham; Bhat, Wasim Ahmad

doi:10.1111/1556-4029.14750

Cited by 6 publications

(3 citation statements)

References 48 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…12 Mobile forensics a type of digital forensics, is a field that is still under development, and due to the varying nature of smartphone operating systems, extracting useful data as evidence proves to be a challenge. 13 Existing research in the field of forensics focuses mainly on analyzing log files, recovering data from memory, 14,15 databases, 16,17 file-systems, 18 network traffic, 19 etc. During mobile evidence collection, investigators mainly focus on collecting Message (SMS and MMS) data, call records, Location details, images, SIM card details, etc.…”

Section: Literature Reviewmentioning

confidence: 99%

Toward social media forensics through development of iOS analyzers for evidence collection and analysis

Hyder,

Arshad,

Fatima

2024

Concurrency and Computation

View full text Add to dashboard Cite

SummarySocial media usage in mobile phones has increased substantially in recent times, and they are a critically important source of a forensics investigation. In this paper, we have developed Python‐based forensic analyzers that are integrated with the open‐source tool Autopsy. The proposed analyzers find forensic artifacts from the three most widely used social media messaging applications, that is, WhatsApp, Instagram, and Facebook Messenger. This research focuses on finding forensic artifacts stored by these social media applications on an iOS device. These analyzers extract data critical for a forensic investigation such as text messages, media attachments, sender and receiver details, timestamps, contact information, and other related forensics data from the full file system image of iOS devices. These Python‐based plugins extract the required data from the social media applications' databases and present the evidential artifacts in a human‐readable format. We integrated these analyzers into the Autopsy Forensics tool and showcased the gathered evidence so that investigators are capable to analyze the extracted information effortlessly. The data integrity is maintained by converting it into readable form without permanently altering the database format. The results prove that the proposed analyzers can successfully extract and analyze forensics data at a low computational overhead.

show abstract

Section: Literature Reviewmentioning

confidence: 99%

Toward social media forensics through development of iOS analyzers for evidence collection and analysis

Hyder,

Arshad,

Fatima

2024

Concurrency and Computation

View full text Add to dashboard Cite

show abstract

“…Because Android is the most popular smartphone operating system (OS) (AlZahrani et al, 2021) and Samsung is the most popular hardware for Android OS (Bhat et al, 2019) we have considered Samsung Android phones as the platform for the experiments conducted in the study.…”

Section: Research Design 31 Case Studymentioning

confidence: 99%

To sell, or not to sell: social media data-breach in second-hand Android devices

Benrhouma

Alzahrani

Alkhodre

et al. 2021

ICS

Self Cite

View full text Add to dashboard Cite

Purpose The purpose of this paper is to investigate the private-data pertaining to the interaction of users with social media applications that can be recovered from second-hand Android devices. Design/methodology/approach This study uses a black-box testing-principles based methodology to develop use-cases that simulate real-world case-scenarios of the activities performed by the users on the social media application. The authors executed these use-cases in a controlled experiment and examined the Android smartphone to recover the private-data pertaining to these use-cases. Findings The results suggest that the social media data recovered from Android devices can reveal a complete timeline of activities performed by the user, identify all the videos watched, uploaded, shared and deleted by the user, disclose the username and user-id of the user, unveil the email addresses used by the user to download the application and share the videos with other users and expose the social network of the user on the platform. Forensic investigators may find this data helpful in investigating crimes such as cyber bullying, racism, blasphemy, vehicle thefts, road accidents and so on. However, this data-breach in Android devices is a threat to user's privacy, identity and profiling in second-hand market. Practical implications Perceived notion of data sanitisation as a result of application removal and factory-reset can have serious implications. Though being helpful to forensic investigators, it leaves the user vulnerable to privacy breach, identity theft, profiling and social network revealing in second-hand market. At the same time, users' sensitivity towards data-breach might compel users to refrain from selling their Android devices in second-hand market and hamper device recycling. Originality/value This study attempts to bridge the literature gap in social media data-breach in second-hand Android devices by experimentally determining the extent of the breach. The findings of this study can help digital forensic investigators in solving crimes such as vehicle theft, road accidents, cybercrimes and so on. It can assist smartphone users to decide whether to sell their smartphones in a second-hand market, and at the same time encourage developers and researchers to design methods of social media data sanitisation.

show abstract

“…Anti-forensics aims to prevent, hinder, or corrupt the forensic process of evidence acquisition, its analysis, and/or its admissibility [1,2]. Among many anti-forensic attacks, file wiping is the most common anti-forensic attack in which a file is completely overwritten by some random data [3].…”

Section: Introductionmentioning

confidence: 99%

Forensic analysis of anti‐forensic file‐wiping tools on Windows

AlHarbi

Alzahrani

Bhat

2021

Journal of Forensic Sciences

Self Cite

View full text Add to dashboard Cite

This paper presents forensic analysis of anti‐forensic file‐wiping tools on the Windows platform. The goal is to identify and extract the evidence of the tools used to wipe files and the files wiped by them on the Windows operating system. To achieve this goal, we analyzed the changes made by these tools to metadata structures of Windows file systems during file wiping. We also analyzed Registry keys and .lnk files to collect the evidence. Our experiments used four file‐wiping tools (SecureDelete v1.0, Secure Eraser v5.2, PC Shredder v1.1, and Blank and Secure v5.88) to wipe files on three Windows file systems (FAT32, exFAT and NTFS). The results suggest that FAT32 and exFAT file system directory structures and $MFT entries of NTFS file system can confirm the use of wiping tools, identify these tools and provide the remnants of the wiped files. Also, $LogFile and $UsnJrnl files of NTFS file system, and Windows Registry keys provide detailed evidence of wiping tools used and the files wiped by them. We also found that the contents of resident and non‐resident alternate data streams, $LogFile and $UsnJrnl files, and Windows Registry keys are not wiped by these tools. Finally, this study makes many recommendations, highlights the limitations of the work and points out the future scope.

show abstract

Forensic analysis of Twitch video streaming activities on Android

Cited by 6 publications

References 48 publications

Toward social media forensics through development of iOS analyzers for evidence collection and analysis

Toward social media forensics through development of iOS analyzers for evidence collection and analysis

To sell, or not to sell: social media data-breach in second-hand Android devices

Forensic analysis of anti‐forensic file‐wiping tools on Windows

Contact Info

Product

Resources

About